In order for a computer to function properly in a network environment, the computer must be appropriately configured. Among other things, this configuration process establishes the protocol and other parameters by which the computer transmits and receives data. In one common example, a plurality of computers are networked to create a local area network (LAN). In the LAN, each computer must be appropriately configured in order to exchange data over the network. Since most networks are customized to meet a unique set of requirements, computers that are part of different networks are generally configured in different manners in order to appropriately communicate with their respective networks.
While desktop computers generally remain a part of the same network for a substantial period of time, laptops, handhelds, personal digital assistants (PDAs), cellphones or other portable computers (collectively “portable computers”) are specifically designed to be transportable. As such, portable computers are connected to different networks at different times depending upon the location of the computer. In a common example in which the portable computer serves as an employee's desktop computer, the portable computer is configured to communicate with their employer's network, i.e., the enterprise network. When the employee travels, however, the portable computer may be connected to different networks that communicate in different manners. In this regard, the employee may connect the portable computer to the network maintained by an airport, a hotel, a cellular telephone network operator or any other locale in order to access the enterprise network, the Internet or some other on-line service. The portable computer is also commonly brought to the employee's residence where it is used to access various networks, such as, the enterprise network, a home network, the Internet and the like. Since these other networks are configured somewhat differently, however, the portable computer must also be reconfigured in order to properly communicate with these other networks. Typically, this configuration is performed by the user each time that the portable computer is connected to a different network. As will be apparent, this repeated reconfiguration of the portable computer is not only quite time consuming, but is also prone to errors. The reconfiguration procedure may even be beyond the capabilities of many users or in violation of their employer's IT policy. Accordingly, special software must also typically be loaded onto the user's computer to support reconfiguration.
In addition, user digital communications addresses such as internet or IP addresses are conventionally associated with a fixed physical location, such as a user's business telephone line. However, portable communications devices such as laptop computers are becoming increasingly popular, and it is common for a user to access the internet from locations as diverse as hotel rooms and airplanes.
Digital communications networks are set up to route communications addressed to a communication address to the associated physical location. Thus, if a laptop computer is connected to a remote location, communications to and from the computer will not be associated with the user's communications address.
In order for a computer (host) to communicate across a network (e.g., the internet), software protocols (e.g., Transport Control Protocol/Internet Protocol (TCP/IP)) must be loaded into the host. A host computer sends information (i.e., packets of data) to devices on the network (routers) which receive the packets and send the packets back to the destination host.
The destination host will route replies back using a similar process. Each host computer and router must be configured so it will know who to send the packets of data to. A router will receive the packets only if the host computers specifically send (address) the packets to that router. If a host is configured incorrectly (bad address), then the host computer and router will be unable to communicate.
With the advent of mobile computers (laptops) and the desire to plug them into various networks to gain access to the resources on the network and internet, a mobile computer must be configured for each network it plugs into. Traditionally this new configuration can be done either (i) manually in software on the mobile computer (usually causing the mobile computer to be restarted to load in the new configuration), or (ii) with a new set of protocols which must be utilized on the mobile computer to obtain the configuration information from a device on the network to which the computer is being connected. When new services (protocols) are created to add functionality to the host computers, these new protocols must be updated in the host computers or routers, depending upon the type of new functionality being added.
As described by U.S. patent application Ser. No. 08/816,174 now abandoned and U.S. Provisional Patent Application Nos. 60/111,497, 60/160,973, 60/161,189, 60/161,139, 60/160,890 and 60/161,182, a universal subscriber gateway device has been developed by Nomadix, Inc. of Westlake Village, Calif. The contents of these applications are incorporated herein by reference. The gateway device serves as an interface connecting the user to a number of networks or other online services. For example, the gateway device can serve as a gateway to the Internet, the enterprise network, or other networks and/or on-line services. In addition to serving as a gateway, the gateway device automatically adapts to a computer, in order that it may communicate with the new network in a manner that is transparent both to the user and the new network. Once the gateway device has appropriately adapted to the user's computer, the computer can appropriately communicate via the new network, such as the network at a hotel, at home, at an airport, or any other location, in order to access other networks, such as the enterprise network, or other online services, such as the Internet.
The portable computer user, and more specifically the remote or laptop user, benefits from being able to access a myriad of computer networks without having to undergo the time-consuming and all-too-often daunting task of reconfiguring their host computer in accordance with network specific configurations. In addition, no additional software need be loaded onto the computer prior to connection to the other network. From another perspective, the network service provider benefits from avoiding “on-site” visits and/or technical support calls from the user who is unable to properly re-configure the portable computer. In this fashion, the gateway device is capable of providing more efficient network access and network maintenance to the user and the network operator.
Gateway devices are typically used to provide network access to the remote portable computer user, such as users in hotels, airports and other locations where the remote portable computer user may reside. Additionally, gateway devices have found wide-spread use in multi-resident dwellings as a means of providing the residents an intranet that networks the residents, broadband Internet access and the capability to adapt to the variances of the resident's individual enterprise networks. With the advent of even smaller portable computing devices, such as handhelds, PDAs, and the like, the locations where these users may reside becomes almost limitless.
User access to computer networks has been traditionally based upon the identity of the computer or computer user rather than the location of the accessing computer. For example, in conventional dial up modem access to computer networks, such as the Internet, a user must typically enter identification information such as the user's name and password. This user input information is then compared to a database of user profiles to determine if the user should be granted access. The database may also indicate the type of access and other related information, such as fees due. For example, where a subscriber to an Internet Service Provider (ISP) has purchased Internet access, a user profile database may contain information which not only enables the user to be authenticated, but tracks the user success for accounting purposes, such as maintaining a history of the user's access time on the network.
However, where the location-based access is established, access to the network cannot be based upon an individual user or computer, as multiple persons can obtain access from a given location, possibly utilizing different computers. Moreover, requiring each user to enter identification information for access overrides any convenience offered by simple, transparent location-based access to computer networks. Transparent network access is also impeded where access is not based upon location-based identification, but rather based upon user input identification information, where the gateway device enables a user to access networks based upon the user's computer settings. For instance, if a user's computer is configured to access a home network, identifying the computer may require the computer to be reconfigured.
Typical network access servers typically allow access to a server based upon a user's information, such as a user name. Authentication was typically done via a user name and password, which is an all or nothing approach. In other words, a user is either allowed access or denied access to a network. Therefore, user's can not be dynamically authorized access to a network such that the user's access and authorization to particular networks or sites can be determined and varied based upon attributes associated with the user, user's location, or packets received from the user's computer.
What is needed is an AAA method and system that allows users dynamic access based upon any number of variables, such as a user's location, a user name or password, a user's location. It would be advantageous for a user to be authorized access based on these variables. Furthermore, it would be advantageous for users to have flexible access to particular sites or services based upon these attributes. Therefore, an ISP or enterprise network can selectively permit access to users, and permit the user.
Therefore, an Authentication, Authorization and Accounting method and system would be desirable which enables a user transparent access to a computer network employing a gateway device, where the computer network can dynamically and selectively authorize a network access. Furthermore, authentication and access rights can be transparently based upon the location from which access is requested, or based upon another attribute associated with the user's computer so that the user is not required to be queried for information and no additional configuration software need be loaded on the user's computer. Moreover, if the user is queried for access information, the user's data should be stored such that subsequent attempts to access the network do not require the user to establish authorization.